1
answer

Exec block with regular expression

Can you explain what exactly happens in this block?
I don't get a clear explanation of what "xEF\xBB\xBF" means in the below code and why it is having drop ()? .

<Exec>
if $raw_event =~ /^(\xEF\xBB\xBF)?(date-time,|#)/ drop();
else
{
csv_parser->parse_csv();
$EventTime = parsedate(${date-time});
}
</Exec>

AskedApril 10, 2019 - 9:24pm
1
answer

Multiline Headerline Regex Error

I am trying to use the multlog module in order to start ingesting a custom log:

I have the following regex: \^(\d{2}|\d).(\d{2}|\d).(\d{4})\s(\d\d|\d):(\d\d|\d):(\d\d|\d)\s(AM|PM).\[(.*)\](.*)

This works in a regex test; however I cannot get it to work with the log file that looks something like this

9/10/2015 11:29:16 AM [0-3-1-SecondaryPortStatus.cs-17] GetStatus for IP: 192.168.0.231 on port: 5016

AskedSeptember 15, 2015 - 4:12pm